TEP-0135 isolating pipelineruns and multitenancy

[jimmyjones2]

This feature uses podAffinityTerm - only running one PipelineRun per worker node using a label selector. However if there are multiple namespaces/tenants using Tekton, if there are PipelineRuns of one tenant already running a node, it'll prevent a PipelineRuns from another tenant from scheduling there.

Is this the desired behaviour? Or should the label selector include a namespace, making it one PipelineRun per tenant/namespace can run on each worker node?

[QuanZhang-William]

Hi @jimmyjones2 👋 . Thanks for your questions.

I think the current behavior is expected and a namespace is not involved. This is an alpha feature and we are looking for feedbacks for it: #6990.

Please feel free to start a FR with your use case. We are happy to review and improve!

/cc @lbernick

[lbernick]

Thanks @jimmyjones2 and @QuanZhang-William; this sounds like a reasonable feature to support! I think we can use this issue for tracking the FR; @jimmyjones2 would you mind giving a bit more detail on your use case?

[jimmyjones2]

Hey @lbernick - not sure if there is too much more detail to give! My use case would be shared clusters - I think in the general case you wouldn't want the activity of one tenant to affect another